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Prepared Remarks for CPA Pre-Rulemaking Listening Session - June 28, 2022 


Good afternoon, and thank you for the opportunity to participate today. My name is David 
LeDuc, I’m the Vice President for Public Policy at the Network Advertising Initiative (NAI). 


The NAI is the leading self-regulatory association for advertising technology. For over 20 
years, we have promoted digital advertising by maintaining and enforcing the highest 
industry standards for the collection and use of consumer data. 


We appreciate the opportunity to provide input as you develop draft implementing 
regulations for the Colorado Privacy Act. 


With five comprehensive state consumer privacy laws expected to become operative in 
the next 12 months, and many more states considering new laws, we are facing an 
inconsistent set of rules that is likely to confuse consumers, and a disparate set of 
obligations that will make compliance nearly impossible for businesses, particularly 
smaller businesses. 


We therefore strongly support your goal to take a collaborative approach for regulations, 
and to work with other states to harmonize the requirements to the greatest extent 
possible. 


This coordinated approach can greatly benefit consumers in Colorado and across the 
country, and businesses that need to comply with these differing laws. This will also be to 
the overall benefit of the Colorado economy, and the U.S. economy, both of which are 
increasingly data-driven. 


The NAI submitted formal written comments last week, and | will summarize some key 
points today, particularly regarding “Universal Opt-Out Mechanisms”. 


The NAI has a long history of promoting consumers’ ability to express their preferences 
and exercise control through easy-to-use choice mechanisms. This is a foundational 
element of tailored advertising that we have championed for decades. 


Broad and consistent recognition of these Mechanisms is essential to minimize confusion 
among consumers, and businesses who honor them in not just Colorado, but also 
California, Connecticut, and other states if they can be developed and implemented 
effectively. 
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Consistent with the CPA’s directive to ensure that companies are not unfairly 
disadvantaged in the marketplace, we encourage you to prioritize the following 
objectives: 


First, clearly require that any such Mechanism is activated by consumers, not turned on- 
by-default, and therefore reflects a clear choice by the consumer to opt out. 


The digital media market is diverse and evolving, and we need it to remain competitive. 
Technology intermediaries shouldn’t be in a position to implement technical mechanisms 
that favor their own business models tied to legal compliance requirements, if the 
mechanisms don’t reflect a clear choice by consumers. 


Second, to achieve the goal above, carefully review opt-out mechanisms designed for 
compliance with the CPA. An effective review process should be informed by input from 
stakeholders, particularly businesses to which the signals are directed. Additionally, we 
encourage ongoing review to periodically evaluate and test approved signals to ensure 
that they continue to be administered fairly over time. 


Third, avoid development of prescriptive technological standards, and refrain from 
seeking to promote a singular technological mechanism. Instead, we encourage you to 
allow for various technology providers, or self-regulatory groups, to develop mechanisms 
that work effectively across various platforms. 


Fourth, clarify that application of choices made via a mechanism applies only to the 
browser or device from which such choice is made, except in those cases where a user’s 
choice can be accurately applied more broadly to a particular consumer, where that 
consumer is known to the entity. 


Businesses should neither be required to collect additional data from consumers to apply 
the opt out more broadly, nor required to take steps to tie pseudonymous identifiers to 
known consumers in cases where they do not already perform these practices. 


Fifth, clarify how a business may be able to prompt a user to disregard or override a signal, 
for instance, in cases where that business has obtained opt-in consent to share the 
consumer’s data in accordance with clear terms provided by the business to the 
consumer. 


These circumstances will be very common as more and more publishers and advertisers 
seek opt-in consent to utilize consumer data for advertising and marketing. Businesses 
need an effective opportunity to reconcile these conflicting signals efficiently and fairly. 
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| would also like to briefly highlight several additional important issues that we addressed 
in our written comments. 


1. Enforcement - The NAI recommends that you utilize your enforcement discretion 
to provide for a reasonable cure period after January 1, 2025, in cases where the 
business has demonstrated a reasonable attempt to comply with the CPA and 
implementing regulations and is not a repeat offender. For example, the 
Connecticut Data Privacy Act establishes a practical set of criteria. 


2. Dark patterns - The NAI published a resource on Best Practices for User Choice 
and Accountability in April 2022, drawing from the FTC and state law policies and 
enforcement actions. We encourage you to use this as a resource in your 
consideration creating rules and enforcing around dark patterns. 


3. Data Protection Assessments - The NAI encourages you to develop and implement 
regulations that seek to harmonize, to the greatest extent possible, with the other 
state laws, and clarify that a company need not create a Colorado-specific data 
protection assessment, provided that the pre-existing assessment meets Colorado 
substantive requirements and that the analysis be focused on key types of use and 
harm to consumers to best protect consumers. 


Thank you again for the opportunity to provide input on this important subject. We look 
forward to continuing to engage with you on these and other key aspects of CPA 
implementation. 


